vicarian 0.4.0

Vicarian is a TLS-first reverse-proxy server with ACME support
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

pub mod acme;
pub mod handler;
pub mod host;
pub mod store;
#[cfg(test)]
mod tests;
pub mod watcher;

use std::sync::Arc;

use crate::{
    RunContext,
    certificates::{acme::AcmeRuntime, store::CertStore, watcher::CertWatcher},
    config::TlsConfig,
};
use anyhow::Result;
use futures::future::try_join_all;
use futures_lite::{StreamExt, stream};

pub use host::HostCertificate;


/// Top-level certificate management; loads supplied certificates,
/// starts a watcher on them, and starts the ACME runtime.'
pub struct CertificateRuntime {
    acme: Arc<AcmeRuntime>,
    certstore: Arc<CertStore>,
    context: Arc<RunContext>,
}

impl CertificateRuntime  {
    pub fn new(context: Arc<RunContext>) -> Result<Self> {
        let certstore = Arc::new(CertStore::new(context.clone())?);
        let acme = Arc::new(AcmeRuntime::new(certstore.clone(), context.clone())?);

        Ok(Self {
            acme,
            context,
            certstore,
        })
    }

    pub fn acme(&self) -> &Arc<AcmeRuntime> {
        &self.acme
    }

    pub fn certstore(&self) -> &Arc<CertStore> {
        &self.certstore
    }

    async fn load_local_certs(&self) -> Result<Vec<HostCertificate>> {
        let iter = self.context.config.vhosts.iter();
        let certs: Vec<HostCertificate> = stream::iter(iter)
            .filter_map(|vhost| match &vhost.tls {
                TlsConfig::Cert(tcf) => Some(tcf),
                _ => None,
            })
            .then(|tfc| HostCertificate::new(
                tfc.keyfile.clone(),
                tfc.certfile.clone(),
                tfc.reload))
            .try_collect().await?;

        Ok(certs)
    }

    pub async fn run_indefinitely(&self) -> Result<()> {
        let certs = self.load_local_certs().await?;
        self.certstore.upsert_all(certs)?;

        let mut certwatcher = CertWatcher::new(self.certstore.clone(), self.context.clone());

        let acme = self.acme.clone();
        let acme_handle = tokio::spawn(async move {
            acme.run().await
        });

        let watcher_handle = tokio::spawn(async move {
            certwatcher.watch().await
        });

        try_join_all(vec![acme_handle, watcher_handle]).await?;

        Ok(())
    }

}